CVE-2023-2001

An issue has been discovered in GitLab CE/EE affecting all versions before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An attacker was able to spoof protected tags, which could potentially lead a victim to download malicious code.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2001.json	Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/406764	Broken Link
https://hackerone.com/reports/1908423	Permissions Required Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*

History

14 Jun 2023, 01:25

Type	Values Removed	Values Added
CPE		cpe:2.3:a:gitlab:gitlab:::::enterprise:::* cpe:2.3:a:gitlab:gitlab:::::community:::*
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.3
CWE		NVD-CWE-noinfo
First Time		Gitlab Gitlab gitlab
References	~~(MISC) https://hackerone.com/reports/1908423 -~~	(MISC) https://hackerone.com/reports/1908423 - Permissions Required, Third Party Advisory
References	~~(CONFIRM) https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2001.json -~~	(CONFIRM) https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2001.json - Vendor Advisory
References	~~(MISC) https://gitlab.com/gitlab-org/gitlab/-/issues/406764 -~~	(MISC) https://gitlab.com/gitlab-org/gitlab/-/issues/406764 - Broken Link

07 Jun 2023, 17:28

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-06-07 17:15

Updated : 2023-12-10 15:01

NVD link : CVE-2023-2001

Mitre link : CVE-2023-2001

CVE.ORG link : CVE-2023-2001

JSON object : View

Products Affected

gitlab

gitlab

CWE

NVD-CWE-noinfo

{"id": "CVE-2023-2001", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "cve@gitlab.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2023-06-07T17:15:09.967", "references": [{"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2001.json", "tags": ["Vendor Advisory"], "source": "cve@gitlab.com"}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/406764", "tags": ["Broken Link"], "source": "cve@gitlab.com"}, {"url": "https://hackerone.com/reports/1908423", "tags": ["Permissions Required", "Third Party Advisory"], "source": "cve@gitlab.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "An issue has been discovered in GitLab CE/EE affecting all versions before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An attacker was able to spoof protected tags, which could potentially lead a victim to download malicious code."}], "lastModified": "2023-06-14T01:25:39.517", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "23B36DD0-0B07-4CF1-A521-A58D43C6CB26", "versionEndExcluding": "15.10.8"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "FCB6D202-8EC7-4305-A540-8E9EC1E7F337", "versionEndExcluding": "15.10.8"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "C612DD9C-BFBD-49A3-9936-BB7D2C7ADBED", "versionEndExcluding": "15.11.7", "versionStartIncluding": "15.11.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "A6944880-86FD-4D58-8217-667BD48B019A", "versionEndExcluding": "15.11.7", "versionStartIncluding": "15.11.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "C060C573-5005-487A-8AB2-DE66531685A1", "versionEndExcluding": "16.0.2", "versionStartIncluding": "16.0.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "D19BAB29-C57C-4410-A093-44AFFF3984DF", "versionEndExcluding": "16.0.2", "versionStartIncluding": "16.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@gitlab.com"}